@nexus-cortex/cli 4.133.1 → 4.133.3

package/.env.defaults

@@ -2221,6 +2221,17 @@ PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=
 # 6c460bfc3 with default 2 — corrected to 1 the same day after finding the 10-19 design.) Unit tests
 # browseAgentPolicy.test.ts; live check: the Browse delegate runs with CORTEX_BROWSE_AGENT=true.
 #CORTEX_MAX_AGENT_DEPTH=
+# CORTEX_TOOL_PARENT_DEPTH — INTERNAL marker (do not set by hand): every process an agent's tool starts (Bash, …; core toolChildEnv) carries
+#   the depth of the agent that started it. bin/cortex.js refuses to start ANOTHER agent from such a process (prompt / agent / run / TUI,
+#   and the agent-launching subcommands autoresearch, message, tmux; exit 3, "use the Task tool"); info commands still work. Closes the
+#   gap where a sub-agent ran `cortex …` through Bash and got an unbounded fresh agent (often on the parent's shared :4000 server at
+#   depth 0). Empty = unmarked (the vitest configs blank it so suites run from an agent's Bash behave).
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] (4.133.2 CI-failed, never on npm) operator 11-12 "fix the sub-agent nesting gap". Evidence: bin refusal + toolChildEnv marker tests.
+#CORTEX_TOOL_PARENT_DEPTH=
+# CORTEX_ALLOW_NESTED_AGENT — operator override for the guard above: true (REAL env only) lets a tool-started process launch cortex
+#   agents again. Default unset = refused.
+# [LEDGER 2026-11-12 @4.133.3 SHIPPED ON] default unset (guard on).
+#CORTEX_ALLOW_NESTED_AGENT=
 TMUX_BIN=
 # Google Vertex AI project (only when using Vertex instead of the Gemini API)
 GOOGLE_CLOUD_PROJECT=

package/bin/cortex.js

@@ -124,6 +124,21 @@ const COMMANDER_SUBCOMMANDS = new Set([
   'secrets', 'canon', 'features', 'sessions', 'server', 'browser', 'desktop',
 ]);
 const __firstPositional = args.find((a) => !a.startsWith('-'));
+// 2026-11-12 sub-agent NESTING GUARD: an agent's tool (Bash …) marks its children with CORTEX_TOOL_PARENT_DEPTH (core toolChildEnv). From
+// there, anything that would start ANOTHER agent conversation is refused: a prompt / `agent` / `run` / the TUI, and the agent-launching
+// subcommands (autoresearch, message, tmux). Info commands (--version, --help, --sessions, --stats, config, secrets, canon, update …) still
+// work. Sub-agents go through the bounded Task tool. CORTEX_ALLOW_NESTED_AGENT=true (real env) is the operator override.
+{
+  const __parent = process.env.CORTEX_TOOL_PARENT_DEPTH;
+  const __infoOnly = args.some((a) => ['--help', '-h', '--sessions', '--stats', '--list-models', '--models'].includes(a));
+  const __launches = !__infoOnly && (!__firstPositional || !COMMANDER_SUBCOMMANDS.has(__firstPositional) || ['autoresearch', 'message', 'tmux'].includes(__firstPositional));
+  if (__parent && __launches && process.env.CORTEX_ALLOW_NESTED_AGENT !== 'true') {
+    process.stderr.write(`cortex: refused — this command was started by an agent's tool (agent depth ${__parent}), and it would start another agent. `
+      + 'Use the Task tool to delegate to a sub-agent (it is depth-bounded); do not launch cortex from a shell inside an agent. '
+      + '(Operator override: CORTEX_ALLOW_NESTED_AGENT=true.)\n');
+    process.exit(3);
+  }
+}
 if (__firstPositional && COMMANDER_SUBCOMMANDS.has(__firstPositional)) {
   // A few delegated subcommands talk to the cortex server over HTTP (they connect via
   // CortexClient to localhost:PORT). Auto-start the server first so e.g.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexus-cortex/cli",
-  "version": "4.133.1",
+  "version": "4.133.3",
   "description": "Nexus Cortex CLI - Terminal interface for multi-provider LLM orchestration",
   "main": "dist/index.js",
   "type": "module",
@@ -19,7 +19,7 @@
     "prepack": "node ../../scripts/copy-pkg-cortex-scaffold.mjs"
   },
   "dependencies": {
-    "@nexus-cortex/core": "4.133.1",
+    "@nexus-cortex/core": "4.133.3",
     "chalk": "^4.1.2",
     "cli-spinners": "^2.9.0",
     "commander": "^11.0.0",